Critical Rails Active Storage Flaw Exposes Server Files via Image Uploads

Ruby on Rails released security updates for CVE-2026-66066, a critical Active Storage vulnerability rated CVSS 9.5 that could allow unauthenticated attackers to read arbitrary files from application servers through crafted image uploads. The issue affects applications that use libvips for Active Storage image processing and accept untrusted image uploads, creating a trust-boundary failure in which Rails passes attacker-controlled attachments to unsafe libvips operations. Exposed data could include secret_key_base, the Rails master key, database credentials, cloud storage credentials, and API tokens.

Rails published patched releases 7.2.3.2, 8.0.5.1, and 8.1.3.1, which also appeared in the project's GitHub release tags. Deployments must also use libvips 8.13+ and ruby-vips 2.2.1+ where ruby-vips is installed, while applications on end-of-life Rails 7.0 and 7.1 must upgrade to a supported branch. Rails advised operators to rotate any secrets readable by the application process after patching; at the time of reporting, no public proof-of-concept or confirmed in-the-wild exploitation had been disclosed, and CISA had not added the flaw to its Known Exploited Vulnerabilities catalog.